Biometric measures profiling analytics

ABSTRACT

A biometric measures profiling analytics system and method are presented. The system and method include collecting biometric data associated with a consumer, and determining one or more biometric variables representing a measurable aspect of the biometric data. The system and method further include generating, based on at least one of the one or more biometric variables, at least one biometric profile variable associated with the consumer, the at least one biometric profile variable representing a degree of normality or abnormality of the collected and calibrated biometric data as compared to a biometric history of the consumer. The system and method further include generating a behavioral score for the consumer based on the collected and calibrated biometric data and with at least one biometric profile variable, the behavioral score representing a degree of risk of normality or abnormality of an event associated with the biometric data.

TECHNICAL FIELD

The subject matter described herein relates to biometric measurements,and more particularly to analytics systems and methods using biometricmeasures.

BACKGROUND

In the pursuit of identifying and stopping fraud, there has been anincreased interest in using direct biometric information on a customerto help refine fraud decisions. Examples of this include geo-location,thumbprint/fingerprint, voiceprints, user gait, facial recognition, etc.Using such biometrics typically involves customer opt-in, correct useradministration of the biometrics capture, and, typically, aninhomogeneous set of user capture devices and capabilities. Thiscontributes to a variety of false positives associated with determiningmatching of the biometric markers. Further, the variety of opt-inprocesses due to privacy concerns, and the mix of biometrics collectedresults in users with either less biometrics captured, and/or differentquality of capture, which further makes reliance on any particularbiometric match difficult for the general population. Finally, aconsistency among measurement devices varies considerably, making theuse of biometrics difficult. Biometric matching that works in anexperimental setting becomes difficult to implement operationally atreasonable false positives, particularly with a public that may resistthe use of this information, and which has come to expect that capturingand disseminating biometric data not be present in the use of theirpayment cards when making a purchase.

As used herein, the term “friction” relates to how much a customer oruser is encumbered by a process, or how or to what extent such personhas to pay attention to the process. Hard matches with biometrics,although powerful indicators of correct identity, can often increase thefriction of the customer experience with false positives and reduceadoption while driving customers to alternate account access and paymentcard experiences where there is less friction. Companies willing to riska lower-friction use of biometric capture and lower false positives willresult in better customer experiences and ultimately larger marketshare.

Practical and wide distribution use of biometric markers are bestcollected in less obtrusive ways to supplement already existing fraudmeasures, such as in the Falcon Manager Fraud product provided by FairIsaac Corporation of San Jose, Calif. Here the quality of eachindividual's biometric data can be used and calibrated based onbiometrics adopted/allowed, a user's proper use of biometric protocol,and device limitations to improve an existing fraud behavior score thatwas generated based on non-biometric transaction data. Analytics must becalibrated based on the user's own biometric measures history and thestability of those measures over time. In this fashion, the biometricmeasures and the quality of this information can supplement a highlypredictive fraud score and can raise (more fraud risk) or lower thescore based on the trending of recently and preferably low-frictionbiometric data collected. In cases where the biometric data isinconclusive, the preexisting score is the dominant determination offraud or non-fraud.

Accordingly, there is an increased interest in the use of biometricinformation to enhance fraud detection. Often the focus is on “highfriction” biometric collection such as facial recognition, retinal scan,or handwriting analysis and utilizing match measures to a reference.Although these can be appropriate in specialized situations, such asgovernment security, they are ill-suited to the general population's useof biometrics to improve fraud detection and authentication.

SUMMARY

This document describes the use of low-friction or no-friction biometricdata gathering to construct one or more biometric measurement profilevariables that track measurement data from no-friction, low-friction,and high-friction measurements to determine the typical values of thesemeasures for each specific individual based on their adoption,implementation of the biometric measurement, and quality of capturedevice. Further, by utilizing Recursive Frequency lists and GlobalQuantile estimation, abnormality variables based on individual andglobal biometric profile variable measurement data can be constructed.Based on these unsupervised or supervised biometric profile analyticstand-alone scores, and a preferred blending of biometric profilemeasure analytics with existing fraud scores, specific actions can begenerated based on biometrics measurements. Tailoring biometricmeasurement data and profiling the individual's biometric measurementsover time allows the interpretation of the data to be based on theindividual's past biometric measurements to increase accuracy and lowerthe false positives associated with use of biometrics data in fraud andauthentication.

The biometric profiling data need not be restricted to fraud problems;the same change detection associated with fraud applications isimportant to understanding change in biometric indicators associatedwith customers, which may mean a number of things, such as they are in alocation for the first time, having challenges matching biometrics, orin need of help/engagement. Archetypes of customers in the space of thebiometric marker data captured can be learned and adjusted in real-timeusing streaming collaborative profiling technology. This allowscustomers to be segmented based on the biometrics captured and actionstargeted based on the archetype(s) to which they belong. Further thesecustomers can be monitored over time, and when biometric data indicateschanges to a customer's archetypes, they enable an ability to interviewor acknowledge a time of flux, which can be of critical importance inmedical applications or strengthen relationships in the “Know YourCustomers” (KYC) area.

In one aspect, a biometric measures profiling analytics system andmethod are presented. The system and method include collecting, by acapturing device connected with at least one programmable processor,biometric data associated with a consumer, and determining one or morebiometric variables associated with the consumer, each of the one ormore biometric variables representing a measurable aspect of thebiometric data. The system and method further include generating, basedon at least one of the one or more biometric variables, at least onebiometric variable profile associated with the consumer, the at leastone biometric variable profile representing a degree of normality orabnormality of the collected and calibrated biometric data as comparedto a biometric history of the consumer. The system and method furtherinclude generating a behavioral score for the consumer based on acomparison of the collected and calibrated biometric data with thebiometric variable profile, the behavioral score representing a degreeof risk of normality or abnormality of an event associated with thebiometric data.

Beyond the use of biometric measures in fraud detection applications toidentify changes over time to determine normal or abnormal measurements,there is also a class of analytics that utilize biometric measures overtime to derive archetypes of these biometric measures. These archetypescan be utilized to classify individuals based on their distribution inthe learned archetypes to which they can be associated, or to understandchanges in archetype distributions over time. These collaborativefiltering techniques on the biometric measures allow more customer-awareanalytic decisions, for example, in the area of medical intervention andmonitoring, or marketing and/or receptiveness by consumers to outreach.

Implementations of the current subject matter can include, but are notlimited to, systems and methods, as well as articles that comprise atangibly embodied machine-readable medium operable to cause one or moremachines (e.g., computers, etc.) to result in operations describedherein. Similarly, computer systems are also described that may includeone or more processors and one or more memories coupled to the one ormore processors. A memory, which can include a computer-readable storagemedium, may include, encode, store, or the like one or more programsthat cause one or more processors to perform one or more of theoperations described herein. Computer implemented methods consistentwith one or more implementations of the current subject matter can beimplemented by one or more data processors residing in a singlecomputing system or multiple computing systems. Such multiple computingsystems can be connected and can exchange data and/or commands or otherinstructions or the like via one or more connections, including but notlimited to a connection over a network (e.g. the Internet, a wirelesswide area network, a local area network, a wide area network, a wirednetwork, or the like), via a direct connection between one or more ofthe multiple computing systems, etc.

The details of one or more variations of the subject matter describedherein are set forth in the accompanying drawings and the descriptionbelow. Other features and advantages of the subject matter describedherein will be apparent from the description and drawings, and from theclaims. While certain features of the currently disclosed subject matterare described for illustrative purposes in relation to an enterpriseresource software system or other business software solution orarchitecture, it should be readily understood that such features are notintended to be limiting. The claims that follow this disclosure areintended to define the scope of the protected subject matter.

DESCRIPTION OF DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, show certain aspects of the subject matterdisclosed herein and, together with the description, help explain someof the principles associated with the disclosed implementations. In thedrawings,

FIG. 1 illustrates a Recursive Frequency List example;

FIG. 2 illustrates a biometric measures profile containing a limitedbiometric measurement history, biometric Recursive Frequency Lists andvariables, and biometric measures with quantile scaling based onassociated peer groups and globally.

FIG. 3 illustrates a fraud and non-fraud table of biometric measuresprofile variable value samples utilized for the use of computingprobabilities of fraud based on biometric profile measures data.

FIG. 4 illustrates the process flow of collecting biometric data,computing biometric measures and associated biometric measures profilevariables, and computing the biometric behavioral score.

When practical, similar reference numbers denote similar structures,features, or elements.

DETAILED DESCRIPTION

To address the above-discussed issues, this document presents methods,systems, articles of manufacture, and the like, consistent with one ormore implementations of the current subject matter to provide biometricmeasures profiling, and analytics using biometric measures profiling.

In accordance with some implementations, low-friction biometric data caninclude one or more of the following usage behaviors of a mobile devicethat can be collected based on user consent and done in the backgroundalthough being conscious of the increased battery draws on the device:

-   -   B-party (destination numbers) called    -   B-party texts    -   B-party MMS    -   URL visited    -   Apps running    -   Data downloaded—such as slacker, Pandora, etc.    -   Data requested    -   Location lat/long    -   Wifi networks connected    -   Gyro position of the phone (how phone is held at angle)    -   Step Motion on the phone (steps taken)    -   Power on/Power off    -   Jail Broken    -   Sleep mode    -   System setting changes    -   Keystroke monitoring/swipes    -   Etc.

High friction biometric data, by contrast, requires a customer to gothrough a procedure for collecting data such as finger prints, voiceprints, facial recognition, retinal scan, genetic signature/DNA, swipinga code/signature on phone, entering a key phrase and monitoring typingspeed, password authentication, etc. High friction biometric data canalso include DNA signatures, blood glucose measurements, sweat analysis,oxygen (O₂) measurement, etc.

The lower the friction of biometric capture, the better the customerexperience and the more likely that a user will opt-in to the collectionof biometric data for use in improving a fraud decision or detection ofa cybersecurity event. The analytics described below encompass lowfriction/no friction biometric capture, as well as higher-frictionbiometric measurement profiling analytics.

Many of the biometric data measures in the low-friction category can becollected as events occur, or as activity is polled on a regular basis(such as every 5, 15, 30 minutes, for example) to provide data that canbe used to determine a normal or an abnormal use of the device.Determining a degree of abnormality requires that biometrics becollected to form a pattern of usage based on the user's past biometricmeasurements. This enables a determination of a typical value of thebiometric measurements for the user and in the context of other users.Events that are consistent with the patterns of past use can help toreinforce a determination that a legitimate user is associated with adevice, whereas those biometric measurements that are determined as notbeing consistent with frequent biometric capture data point to thepossibility of use of the device by someone other than the legitimate,or a drastic change in that user's behavior. The determination of thenormality or abnormality of the biometric measurement data of the deviceneed not correlate to accuracy in match rate of a reference, but moreimportantly indicates typical biometric match levels over time, as anexample a user with a consistent but low match rate of a metric may beconsidered normal. The determination of the normality or abnormality ofthe biometric measurement data of the device occurs in a real-time basisand can then be aligned with a risk decision, such as allowing afinancial transaction to occur, a new application to be installed on thedevice, an online account to be accessed, or data transmitted to/fromthe device.

There are a variety of methods to determine whether biometricmeasurements are aligned with high recurrences of past biometricmeasurements for a user. In some implementations, as discussed below, atransaction profile-based recursive method enables real-timedetermination of repeated behaviors and real-time updating of tablesthat support the determination. In the description below, the term“number” can correspond to a variety of biometric measures, such as adialed number (i.e., a mother's number), a number texted (i.e., bestfriend), data requested from an application (i.e., Slacker, Pandora,etc.), a location of the phone (i.e., a local shopping mall), a facialrecognition match accuracy, voiceprint deviation, etc. All of thesebiometric measures can be characterized by numbers. Each of thebiometric measures can have its own table that indicates typical pastoccurrences of the biometric data for a user over different time/eventscales and/or day/time patterns. It should be noted that continuousvalued numbers can be binned into value ranges to allow recurrences tobe determined.

Determining Recurrence of Biometric Measures

In accordance with some preferred exemplary implementations, a RecursiveFrequency List is generated, and which mathematically summarizes adevice's various biometric measures history. One or more of these listsreside in the device profile and are maintained and updated with eachnew biometric measure data captured. The Recursive Frequency Listutilizes the following three tables, stored in a device profile:

-   -   1. A table of n most frequent numbers (number table)    -   2. A table of pseudo-frequencies of the corresponding n most        frequent numbers (frequency table)    -   3. A table of ranking for these numbers (ranking table)

These three tables are collectively hereafter referred to as a RecursiveFrequency List. It should be noted that the “frequencies” stored in thefrequency table are not true “frequencies,” but rather arepseudo-frequencies that approximate or estimate the true frequencies asapplied over a decayed time or event window. FIG. 1 shows an example ofa frequent-number list.

The Number Table and Frequency Table are coupled via common indices.From the above Number Table and Frequency Table, the frequency fornumber “1111” (with index 1 in the Number Table) is 0.2. The frequencyfor number “2222” (with index 2 in the Number table) has a frequency of0.7. The frequency for number “4321” (with index 14) has a frequency of0.4. The ranking table stores the common indices of number table andfrequency table in the decreasing order of the frequency. For example,referring to the Ranking table, index 11 in the number table(corresponding to number “1234”) has the highest frequency (3.1), index13 (corresponding to the number “3434”) the second-highest frequency(2.3), and so on.

Upon each new biometric measurement, the respective Number table islooked up to determine whether a biometric measurement value isfrequently occurring for that user utilizing the rank of the number fromthe Ranking table. Then, one or more variables are calculated based onwhether the current biometric measurement is frequent or not. Once thelookup is complete, the tables are updated as follows:

-   -   All frequencies in the Frequency table are decayed by a        multiplicative factor β, 0<β<1;    -   Then, the Number table and Frequency table are updated as        follows:        -   If the current number is not in the Number table, then            least-frequent number (determined by the Ranking table) is            replaced with the current number if the least frequent            number's frequency (based on the Frequency table) is less            than a threshold δ,

$0 < \delta < \frac{1}{1 - \beta}$(NOTE: there are a multitude of other implementations for determiningthe threshold δ including use of adaptive thresholds based on matchrates and recycling rates associated with the Number table). Thefrequency of the current number is initialized to be α.

-   -   -   If the current number is already in the Number table, then            its frequency is increased by λ            Finally, the Ranking table is updated to reflect any changes            to the ranking of numbers in the Number Table based on the            update.

“Frequencies” in the frequency table are not true frequencies, but arebased on a ranking associated with the values α, β, and λ which aredependent on application and can vary based on the type of biometricmeasure variable being monitored in the Number table. This allowsgeneration of a pattern of recent biometric measures so that analyticscan be created around the current biometric measures in the context ofthe past biometric measures for a particular customer and their use oftheir device. A period of non-use or non-favorite use may be anindication of a change of user of the phone, which would add risk tosubsequent authentication.

Biometric Measure Profile Variables Based on Recursive Frequency Lists:Individual's View

In some implementations, a system uses one or more Recursive FrequencyLists, which helps determine normalcy patterns of past biometricmeasures, and allows current biometric measurement data to be cast inthe view of a recent history of biometric measures made on the device.This in turn enables patterns of a user's “normalcy” of biometricmeasures to be recursively self-learned in the Recursive Frequency Listcontained in the device profile. As an example, a device that is used bya school child that has a limited set of locations/trajectories traveledduring a school week will be highly stereotyped in location, but perhapsless so stereotyped in application downloads. In contrast, a travelingsalesperson whose locations change rapidly and varied are notnecessarily recurrent, but whose usage of the phone in terms ofapplications utilized (such as airline and travel applications andtexting back to family friends) could be highly normalized, whilelocation and travel trajectory is out of pattern. Variables that trackhow matches on the Recursive Frequency List occur are important inunderstanding the value of each biometric measurement and associatedmeasures variables for each particular user.

As illustrated, variables such as IN_TOP_5 and IN_Number_LIST aretransaction-based measures. Variables such as IN_TOP_5_10Events orIN_NUMBER_LIST_1Week track historical trends of the biometric measurevalues for a user over a number of biometric measurements or over time.Variables such as IN_TOP_5_3EVENTS/IN_TOP_5_10EVENTS measure deviationsin the matching of biometric values of the user over recentmeasurements. It is important to note that these variables are not basedon a notion necessarily of what is a ‘good’ or ‘bad’ biometricmeasurement or match, but rather what is consistent in the history forthe user and tailored based on the individual user's biometric data overtime.

These methods also apply to high-friction biometrics such as facialrecognition. Facial recognition relies on metrics captured of the faceand landmarks that determine one or more measurements such as a distancebetween eyes, nose, size of face, distance to ears, shape of image, etc.These measures are determined based on pictures and compared to abenchmark measurement. The quality of these measures are stronglydependent on a quality of the pictures taken, skill of the user takingthe picture of himself/herself, lighting, engagement of the user, etc.The Recursive Frequency List can be used to determine a past history oftypical match rates and quality of matches and associated measuresvariables to determine whether the trend is consistent. As an example, a‘too perfect’ match might be the result of the use of a static referencepicture, and can be used to easily catch a fraudster in the context ofthe actual user having only a moderate match rate in their history.Another example is a user that very carefully follows an instruction andtakes acceptable pictures of himself or herself (in the right lighting,etc.) and has a consistent error margin in the facial landmark biometricmeasures, where a set of large mismatches can be easily determined basedon a match quality stored in the Recursive Frequency List. These listsallow false positives to be more individually determined.

The Recursive Frequency Lists are stored in a database or NOSQL datastore along with a small history of biometric measurements within thedevice profile. These profiles maintain the variables associated withthe biometric use of the device and normalcy, but also utilize thelimited history of past biometric measurements for example to track themovement of a user that might imply a geographic trajectory.

Context of Global User Biometrics: A Global View

In addition to the individualized Recursive Frequency Lists thatindicate whether a user's biometric data captured is consistent withtheir past biometric history, how that user's measures compares to theGlobal population can also be determined. FIG. 2 illustrates a Deviceprofile structure for Biometric measurement variables and RecursiveFrequency Lists. As illustrated in FIG. 2, the quantiles associated withbiometric profile measures can indicate whether or not the biometricmarkers for an individual and associated biometric measure variables areoutliers compared to the overall population. Biometric markers that areinconsistent with the Recursive Frequency Lists and associated variablesfor a single individual can be further enhanced with respect to what isnormal or abnormal globally—or other words what is the typical range ofvalues for these biometric profile variables across the entire userbase? This can be determined recursively through the use of quantiletracking methods for the variables contained in the device biometricprofile.

To compute online percentile estimators of the variables, varioustechniques can be used. One iteration consists of capturing Mconsecutive observations, where M≥1 is a free parameter. At the n-thiteration, an estimate of x ^(r) is updated; this estimate is denoted byx _(n) ^(r) at the n-th iteration. The i-th observation is denoted inthe n-th iteration as x_(n) ^(i), where i is in [1, M]. At the n-thiteration, a density estimate f_(n) is computed for the variable x atthe r-th percentile using the following equation:

$\begin{matrix}{f_{n} = {{( {1 - w_{n}} )f_{n - 1}} + {w_{n}\frac{\sum\limits_{i = 1}^{M}{1\{ {{{x_{n}^{i} - {\overset{\_}{x}}_{n - 1}^{r}}} \leq c_{n}} \}}}{2c_{n}M}}}} & (1)\end{matrix}$

where 1{·} is an indicator function that takes the value of 1 if thecondition inside the curly brackets is satisfied and 0 otherwise. Theseries w_(n) and c_(n) must satisfy some convergence criteria asdetailed in the research papers cited above. Among many others, onechoice is w_(n)=1/n and c_(n)=1/√{square root over (n)}.

After f_(n) is computed, x _(n) ^(r) is obtained as follows:

$\begin{matrix}{{\overset{\_}{x}}_{n}^{r} = {{\overset{\_}{x}}_{n - 1}^{r} + {w_{n}\frac{r - {\sum\limits_{i = 1}^{M}{1{\{ {x_{n}^{i} \leq {\overset{\_}{x}}_{n - 1}^{r}} \}/M}}}}{e_{n - 1}}}}} & (2)\end{matrix}$

where e_(n)=max{f_(n), f₀/√{square root over (n)}} and f₀ is an initialvalue of f_(n).

Utilizing real-time recursive quantile estimation, the value of each ofthe biometric profile variables can be recast into dimensionless valuesexpressed in terms of the real-time estimate of the quantiles of abiometric metric profile variable distribution. These transformationsare important to allow the variable distribution to change over time andwithin different segments of users/device types and allow biometricprofile variables that have different value ranges to be recast on acommon interpreted scale.

One such dimensionless scale is based on outlier variable scaling. Todetermine the outlier values of the biometric profile variables, thepoint in the distribution of values of the variables is quantified,where if the variable value exceeds that point it can be considered anoutlier. The formula in equation #3 below can be used to produce asimple unconditional re-scaling across all independent variables.

$\begin{matrix}{{{q( {x_{i}❘\theta} )} \equiv \frac{x_{i} - \theta_{i,1}}{\theta_{i,2}}} \in \lbrack {0,C} \rbrack} & (3)\end{matrix}$

where ((θ_(i,1), θ_(i,2))∈θ) are location and scale parametersrespectively of the computed distribution of independent biometricprofile variable x_(i). The scaled value is bounded between 0 and someconstant C to protect the analytics from extreme outlier values.

As an example, a variable Text_Frequency_3Event_20Event could show thattexting frequency is 3.2 times the frequency average over the last 20events, this 3.2 is not easily interpreted but utilizing the globalvariable distribution could correspond to a value of 97% quantile of thedistribution of values across the general population. Utilizing equation#3 where θ₁ is the 95% quantile value and θ₂ the distance between the97% and the 95% quantiles, the biometric profile variableText_Frequency_3Event_20Event has a scaled value of q=1.0. Likewise,other biometric variables would have their own unique real-values ofvalues of θ₁ and θ₂ but in the space of q(x_(i)|θ) can be compared, forexample of 10 biometric profile variables the vector q may take on avalue of:q=(0,0,1.0,0,2.5,0,0,0.37,0,0)

which indicates that, of 10 different biometric profiling variables,three are above the 95% quantile of their respective profile variabledistributions and only two are significant outlier values of 1.0 and2.5. The following equation indicates one of many methods to take thevector Q above and produce an unsupervised score.η=Σw _(i) q(x _(i) |t,s)  (4)

Here the score η is the summation of the q values where the variables inthe q outlier scaling is based on the segment, S, that the devicebelongs such IOS, Android, etc. This use of the Segment S scaling isparamount given the differences in device capabilities and quality ofbiometric measurements based the device characteristics. The weightingw_(i) of different q(x_(i)|t,s) can be based on expert knowledge orlimited training data such that the score η provides a correct rankingof large biometric deviation across a multitude of metrics and does notoveremphasize weak biometric indicators. The larger the score η, themore substantial the deviation and consequently, the need forinvestigation.

Biometric Score Based on Data Outcomes—a Supervised Standalone BiometricProfile Score

One preferred method of utilizing biometric profiling is to blend withan existing fraud practice/score. This section discusses a method togenerate a standalone bio-metric score when such a pre-existing fraudscore is not available to blend. The stand-alone score will utilizeknown fraud and non-fraud attempts to derive an outcome-based scorebased on actual customer biometric use.

In utilizing outcome-based data, recent historical production outcomesof fraud and non-fraud can be aggregated with the associated biometricvariable values (or ranges) to determine the likelihood of fraud basedon fraud and non-fraud history in the stream. This is most easilyobtained utilizing Bayes theorem. In this implementation, fraud andnon-fraud tables are maintained, and the values of the bio-metricprofile variables are binned, such that the continuous values of thevariables fall into discrete bins. It is important to note for biometricprofile based variables that it is naïve to think larger or smallervalues are necessarily more or less risky; the risk associated with thevalues of the biometric-based values will be nonlinear and typicallynon-monotonic which makes Bayes formulation advantageous.

FIG. 3 shows the tables of recent fraud and non-fraud exemplars and thevalues of the raw biometric profile variables associated with the fraudand non-fraud exemplars when takeover of the device had occurred orsuspected fraud occurred.

Based on the data contained in the tables of FIG. 3, the probability offraud can be determined by the Bayes formula. Each record in the tablescontains the values of the biometric variables which can be used todetermine the likelihood of observing a value of the biometric profilevariable value in the fraud or non-fraud table. The model directlyutilizes the fraud and non-fraud tables to compute how similar therecord is to exemplars of fraud and non-fraud contained in the tables.This will allow us to compute P(X|fraud) and P(X|nonfraud), which arethe probability of observing the value of X in the fraud table(P(X|fraud)) and the probability of observing the value of X in thenon-fraud table (P(X|nonfraud)). This provides a probability ofobserving the variable values X in each table, and Bayes rule is thenutilized.

$\begin{matrix}{{P( {{fraud}❘X} )} = \frac{{P( {X❘{fraud}} )}{P({fraud})}}{( {{{P( {X❘{fraud}} )}{P({fraud})}} + {{P( {X❘{nonfraud}} )}{P({nonfraud})}}} )}} & (5)\end{matrix}$

Formula #5 provides an estimate of the probability of fraud given thevalue of X.

The formula above is easy to interpret in the limits, for example if thevalue of 0.7 for the facial match rate is seen with the same probabilityof Λ in both the fraud and non-fraud table, P(X|fraud)=P(X|nonfraud)=Λand with the recognition that P(nonfraud)=1−P(fraud), then equation #5reduces to P(fraud|X)=P(fraud). In other words, the value of 0.7 for thefacial match rate is meaningless and doesn't change the overallprobability of fraud as that value of 0.7 is seen equally see in thefraud and non-fraud tables.

Another extreme would be if the value of 0.85 for the facial matchvariable is 100× more likely in the fraud table then the non-fraudtable, then the formula trends P(X|fraud) to 1. If the facial match rateof 0.85 is 100× more likely in the non-fraud table than in the fraudtable, then the formula trends to 0.

The Bayes formula provides a data driven way to obtain estimates ofprobabilities of fraud for each of the biometric profile variables andtheir specific variable values based on domain specific tables of valuesfor fraud and non-fraud instances. This method has the advantage in thatit is self-learning based on the values of variables stored in thetables. This biometric profile analytic probability could then be useddirectly in the determination of the likelihood that a device is beingtaken over, and provide indication that further actions are required onsubsequent transactions or out-of-band on a payment card transaction.Where there are a small number of records, the formula above can beapproximated by a product of single valued probabilities, for examplewhere there are several estimates of fraud probability based on a singlevariable Xi.

$\begin{matrix}{{P( {{fraud}❘X} )} = {\prod\limits_{1}^{N}\;{P_{i}( {{fraud}❘X_{i}} )}}} & (6)\end{matrix}$

The method above allows either a vector or product of scalarapproximations of the fraud probability to be used to determine aprobability of fraud/takeover based on the biometric profilingvariables.

Biometric Score Based on Data Outcomes—a Blended Biometric ProfilingEnhanced Score

As discussed before, optimally fraud prediction associated with thebiometric monitoring would be used to enhance already existing scores,such as the Falcon Fraud Manager score. This score is highly predictivebut does not utilize a variety of bio-metric measures. The ability toblend the scores is paramount to enhancing the value of score andminimizing the false positives associated with biometrics alone. Asdiscussed previously, false positives will reduce the uptake ofbiometric measures or drive customers to lower friction channels. Highlevels of accuracy in the score and low false positives are essentialfor the success of utilizing biometric variables in decisioning in thegeneral population.

Many score blending algorithms exist, these include simply averagingscores, using a linear or logistic regression model to determine thescore blending, or binning both scores and determining the probabilityof fraud in every cell in the 2-dimensional table containing allpossible combinations of the bins on the two scores. Each has itsadvantages and disadvantages. The simple average is not optimal if thetwo scores have differing statistical strengths and the dual binningapproach takes smooth scores and changes them into discrete values thatare potentially statistically noisy. The regression approach is one thatis most easily implemented given ongoing fraud and non-fraud dataaggregation. Firstly the fraud score is translated to log-odds spacewhere:

$\begin{matrix}{\Omega = {{\ln( \frac{P({fraud})}{1 - {P({fraud})}} )} = {\ln( \frac{E({score})}{1 - {E({score})}} )}}} & (7)\end{matrix}$

where E( ) is the expected value where 0 represents non-fraud and 1represents fraud. This transformation can also be done for eachprobability measure for the biometric profile variable analyticsdescribed above and an improved score can be represented as:

$\begin{matrix}{\Omega^{\prime} = {\Omega + {\sum\limits_{1}^{N}{\alpha_{i}{\ln( \frac{P_{i}( {{fraud}❘X_{i}} )}{1 - {P_{i}( {{fraud}❘X_{i}} )}} )}}}}} & (8)\end{matrix}$

Where training based on fraud and non-fraud exemplars would allow theα_(i) to be learned from historical data. The improved value of thescore is then inverted to be:

$\begin{matrix}{{P^{\prime}({fraud})} = \frac{1}{( {1 + {\exp( {- \Omega^{\prime}} )}} )}} & (9)\end{matrix}$

This allows the prior fraud score P(fraud) mud) to be enhanced with thebiometric profiling variables to produce an improved supervised scoreP′(fraud). In this way, the estimate allows the operations to not changesubstantially in terms of case volume as the score distributions aremore stable in terms of the number of high scoring cases, but thosecases are now more predictive in terms of true fraud flagged at the highscore region. Equation #8 can be periodically retrained as the qualityof the biometrics change over time, and has the advantage that inlog-odds space one needs not worry about the calibration issuesassociated with combining scores. The method above is ideal forenhancing a strong base score, such as a Falcon Fraud Manager Fraudscore, where the value of this score is statistically very significantlystronger than the other biometric predictors.

Biometric Score General Applications: Understanding Archetypes Based onBiometric Profiling

The analytic classification of fraud or authentication is an importantproblem, and one for which the use of profiling of biometric measuresand abnormalities is described. However, the use cases associated withbiometric profiling are considerably larger than fraud, authentication,and abuse. Examples include, but not limited to, biometric dataprofiling for health monitoring, location based services, marketing, anda variety of Know Your Customer (KYC) applications. In all theseapplications, it is essential to look at each biometric stream of dataand profile the individual markers in the biometric stream and createbiometric profile measures to form archetypes based on the biometricdata. For example, based on time/day and steps walked, it can bedetermined when and how often people exercise, and to form archetypes ofmotion/exercise. This data can then be coupled with other data aroundconsumption of meals/snacks or application information to determine howsedentary one's lifestyle is, or, coupled with known health data couldpoint to a lack of adherence to medically prescribed and preventiveexercise.

Collaborative filtering techniques can be used to determine ‘archetypes’of streams of biometric markers whether it be latitude/longitudelocation, application use or health-related markers: pulse, heart rate,glucose, and other medical markers collected throughout the day. Thisdata can then be aggregated to determine the archetypes associated withthe user of the device.

The variety of biometric markers and profile measures can be collectedand aggregated into a multitude of streams, with each having their ownparticular attributes. Although appearing individualized, there are somecertain regularities of classes of users' biometric marker data andassociated biometric profile measures that can be learned using a modeltrained on a large database of the biometric streams. To determine theclasses of user's biometric marker streams, a high dimensional space ofstreams of biometric markers can be used to build models that translatefrom the observed biometric profile measure space to a lower dimensional‘archetype’ space, which encompass the modes of collective behaviorstypically seen in the biometric stream data. A preferred implementationis to model the observed data with a statistical “topic model”, a set oftechniques originally developed, but not limited to, documentclassification. In this setting, the “words” are equated to the directlyobserved discrete biometric marker data and derived profile variables asdescribed above and “topics” are the imputed archetypes estimated by thetopic model.

In some implementations, a Latent Dirichlet Allocation (LDA) model isused, which is a Bayesian probabilistic method that simultaneouslyestimates probability distributions over archetypes (topics) to each ofthe profiled entities, and a probability distribution of biometricmarkers and derived biometric profile variables (words) is generated foreach topic. The latter, in the form of a matrix for a LDA model, iscalled the “model” and represents collective behaviors relating observedbiometric marker data and profile variables to discovered archetypes.The number of archetypes is usually substantially lower than thecardinality of the word space so it can be considered a dimensionalityreduction method.

These archetypes have been shown to be highly interpretable. Therefore,for example, measurements of glucose levels may point to groups ofindividuals at various stages of diabetes. Coupling the archetype that apatient falls into based on recent biometric glucose markers witharchetypes such as diet and exercise could determine whether or not poordiet or lack of exercise contributed to less preferred glucose levels.Reviewing the steps/heart rate can give indications whether or not anexercise program is being adhered to. Other information such asapplication use and/or motion may give indications on how and when aperson may be most receptive to motivational messages/directives.Outside of the medical space, understanding the applications installedand used on mobile devices, coupled with location data, can allow forreal-time marketing to be performed based on low-friction biometricscaptured to improve a customer experience and make offers more relevantin both type of offer and the location/time of offer.

When using the LDA model in scoring mode, the archetype loadings isupdated in real-time within the transaction profile of the user/device.An algorithm to accomplish this is described in U.S. patent applicationSer. No. 14/566,545, entitled “Collaborative Profile-Based Detection OfBehavioral Anomalies And Change-Points,” incorporated herein byreference in its entirety, and which supports the use of analytictechniques to allow for profiling of biometric marker data andassociated profile biometric measures, and for utilizing real-timecollaborative profiling to determine archetypes based on streamingbiometric data. This reference discusses a method for recursivelyupdating the archetypes in a user's transaction profile as data streamsinto a scoring model. Utilizing these techniques allows a set ofreal-time profile-based biometric ‘archetypes’ to be continuallymaintained/refined as real-time biometric data is monitored.

Real-time profiles of archetypes and changes in the archetypes can bedetermined with each newly received biometric marker to track thearchetypes and determine where messaging, marketing, or intervention isrequired. The ability to profile the biometric markers and derivedbiometric profile variables in real-time and determine the real-timearchetypes allocation of behavior is important for making real-timerelevant analytic driven decisions on individuals.

FIG. 4 is a flowchart of a method 100 of executing biometric measuresprofiling analytics in accordance with some implementations of thesubject matter described herein. At 102, biometric data associated witha consumer is collected by a capturing device connected with at leastone programmable processor, or at least one special-purpose dataprocessor. At 104, one or more biometric variables associated with theconsumer are determined. Each of the one or more biometric variablesrepresent a measurable aspect of the biometric data, as described above.At 106, based on at least one of the one or more biometric variables, atleast one biometric variable profile associated with the consumer isgenerated. The at least one biometric variable profile represents adegree of normality or abnormality of the collected and calibratedbiometric data as compared to a biometric history of the consumer. At108, a behavioral score for the consumer is generated based on acomparison of the collected and calibrated biometric data with thebiometric variable profile. The behavioral score represents a degree ofrisk of normality or abnormality of an event associated with thebiometric data.

The behavioral score based on the biometric data can be used todetermine archetypes of behavior among a number of consumers, incollaborative profiling technology to determine those archetypes, and/orfor profiling the biometric data over time or among an aggregated set ofbiometric events. Such methods can also be used to classify consumersbased on their profiles or archetypes, and generate distributions topoint to changes in direction or shifts in the archetypes, which can inturn point to possible intervention with respect to any particularconsumer.

One or more aspects or features of the subject matter described hereincan be realized in digital electronic circuitry, integrated circuitry,specially designed application specific integrated circuits (ASICs),field programmable gate arrays (FPGAs) computer hardware, firmware,software, and/or combinations thereof. These various aspects or featurescan include implementation in one or more computer programs that areexecutable and/or interpretable on a programmable system including atleast one programmable processor, which can be special or generalpurpose, coupled to receive data and instructions from, and to transmitdata and instructions to, a storage system, at least one input device,and at least one output device. The programmable system or computingsystem may include clients and servers. A client and server aregenerally remote from each other and typically interact through acommunication network. The relationship of client and server arises byvirtue of computer programs running on the respective computers andhaving a client-server relationship to each other.

These computer programs, which can also be referred to as programs,software, software applications, applications, components, or code,include machine instructions for a programmable processor, and can beimplemented in a high-level procedural and/or object-orientedprogramming language, and/or in assembly/machine language. As usedherein, the term “machine-readable medium” refers to any computerprogram product, apparatus and/or device, such as for example magneticdiscs, optical disks, memory, and Programmable Logic Devices (PLDs),used to provide machine instructions and/or data to a programmableprocessor, including a machine-readable medium that receives machineinstructions as a machine-readable signal. The term “machine-readablesignal” refers to any signal used to provide machine instructions and/ordata to a programmable processor. The machine-readable medium can storesuch machine instructions non-transitorily, such as for example as woulda non-transient solid-state memory or a magnetic hard drive or anyequivalent storage medium. The machine-readable medium can alternativelyor additionally store such machine instructions in a transient manner,such as for example as would a processor cache or other random accessmemory associated with one or more physical processor cores.

To provide for interaction with a user, one or more aspects or featuresof the subject matter described herein can be implemented on a computerhaving a display device, such as for example a cathode ray tube (CRT), aliquid crystal display (LCD) or a light emitting diode (LED) monitor fordisplaying information to the user and a keyboard and a pointing device,such as for example a mouse or a trackball, by which the user mayprovide input to the computer. Other kinds of devices can be used toprovide for interaction with a user as well. For example, feedbackprovided to the user can be any form of sensory feedback, such as forexample visual feedback, auditory feedback, or tactile feedback; andinput from the user may be received in any form, including, but notlimited to, acoustic, speech, or tactile input. Other possible inputdevices include, but are not limited to, touch screens or othertouch-sensitive devices such as single or multi-point resistive orcapacitive trackpads, voice recognition hardware and software, opticalscanners, optical pointers, digital image capture devices and associatedinterpretation software, and the like.

The subject matter described herein can be embodied in systems,apparatus, methods, and/or articles depending on the desiredconfiguration. The implementations set forth in the foregoingdescription do not represent all implementations consistent with thesubject matter described herein. Instead, they are merely some examplesconsistent with aspects related to the described subject matter.Although a few variations have been described in detail above, othermodifications or additions are possible. In particular, further featuresand/or variations can be provided in addition to those set forth herein.For example, the implementations described above can be directed tovarious combinations and subcombinations of the disclosed featuresand/or combinations and subcombinations of several further featuresdisclosed above. In addition, the logic flows depicted in theaccompanying figures and/or described herein do not necessarily requirethe particular order shown, or sequential order, to achieve desirableresults. Other implementations may be within the scope of the followingclaims.

What is claimed is:
 1. A method comprising: collecting, by a capturingdevice connected with at least one data processor, biometric dataassociated with a consumer; determining, by the at least one dataprocessor, one or more biometric variables associated with the consumer,the one or more biometric variables representing a measurable aspect ofthe biometric data; generating, by the at least one data processor usinga model and based on at least one of the one or more biometricvariables, at least one biometric profile variable associated with theconsumer, the at least one biometric profile variable representing afirst degree of normality of the collected biometric data as compared toa biometric history of the consumer, the model employing a recursivefrequency list (RFL) to summarize a history of the biometric data, theRFL comprising a number table, a frequency table, and a ranking table,the model also distinguishing between normal and abnormal biometricmeasurements of the capturing device based on a history of biometricmeasurements of the capturing device; performing real-time recursivequantile estimation on values of the at least one biometric profilevariable to generate an estimate of quantiles of a biometric metricprofile variable distribution, the performing including recasting thevalues of the at least one biometric profile variable into dimensionlessvalues expressed in terms of a real-time estimate of the quantiles ofthe biometric metric profile variable distribution; comparing, by the atleast one data processor, the biometric data associated with theconsumer with data associated with a global population; calculating, bythe at least one data processor and based on the comparing, at least onescaled value of the at least one biometric profile variable, the atleast one scaled value indicating whether a value of the at least onebiometric profile variable comprises an outlier value, the outlier valuecomprising a value above a threshold quantile of the biometric metricprofile variable distribution determined from the overall population;generating, by the at least one data processor, a behavioral score forthe consumer based on the collected biometric data, the at least onescaled value, and the at least one biometric profile variable, thebehavioral score representing a second degree of normality of abiometric event associated with the biometric history of the consumerand the global biometric profile variable; defining, by the at least onedata processor, one or more archetypes for the consumer based on thebiometric data and the behavioral score, the one or more archetypesdefined utilizing real-time collaborative profiling based on streamingbiometric data collected from the capturing device; blending, by the atleast one data processor, the behavioral score with a fraud score togenerate a blended fraud score, the fraud score indicating a probabilityof fraud for a transaction associated with the consumer, the blendingincluding applying a regression model to blend the behavioral score withthe fraud score; and authenticating, by the at least one data processorand based on the blended fraud score and the one or more archetypes, thetransaction associated with the consumer.
 2. The method in accordancewith claim 1, further comprising generating, by the at least one dataprocessor, the biometric history from a collection of biometric data andan event history over a time period, wherein the biometric datacomprises low-friction biometric data including destination numberscalled at the capturing device, texts sent or received at the capturingdevice, MMS messages sent or received at the capturing device, a URLvisited by the capturing device, Apps running on the capturing device,data downloaded at the capturing device, data requested by the capturingdevice, location of the capturing device, Wifi networks connected by thecapturing device, gyro position of the capturing device, step motion ofthe capturing device, power on/power off of the capturing device, jailbroken status of the capturing device, sleep mode of the capturingdevice, system setting changes on the capturing device, and/or keystrokemonitoring/swipes at the capturing device.
 3. The method in accordancewith claim 1, further comprising: aggregating, by the at least one dataprocessor, one or more streams of biometric markers from a plurality ofconsumers; and associating, by the at least one data processor, theaggregated one or more streams of biometric markers and the at least onebiometric profile variable to the defined one or more archetypes.
 4. Themethod in accordance with claim 3, further comprising: generating, bythe at least one data processor, a model based on the one or streams ofbiometric markers and the at least one biometric profile variable; andassociating, by the at least one data processor, the collected biometricdata and the at least one biometric profile variable with at least oneof the defined one or more archetypes based on the model.
 5. The methodin accordance with claim 4, further comprising associating, by the atleast one data processor, the behavior score with the one or morearchetypes to augment one or more biometric profile variables.
 6. Themethod in accordance with claim 1, further comprising generating, by theat least one data processor, a fraud risk score for the biometricmeasurement based at least in part on the behavioral score, the fraudscore representing a degree of risk that the biometric event isassociated with a fraudulent behavior.
 7. The method in accordance withclaim 6, further comprising augmenting, by the at least one dataprocessor, the fraud score with at least one different biometricbehavioral score.
 8. A method comprising: generating, by at least onedata processor, a fraud risk score for a transaction by a consumer, thefraud risk score representing a degree of risk that the transaction isassociated with a fraudulent behavior; collecting, by a capturing deviceconnected with at least one data processor, biometric data associatedwith a consumer; determining, by the at least one data processor, one ormore biometric variables associated with the consumer, the one or morebiometric variables representing a measurable aspect of the biometricdata; generating, by the at least one data processor using a model andbased on at least one of the one or more biometric variables, at leastone biometric profile variable associated with the consumer, the atleast one biometric profile variable representing a first degree ofnormality of the collected biometric data as compared to a biometrichistory of the consumer, the model employing a recursive frequency list(RFL) to summarize a history of the biometric data, the RFL comprising anumber table, a frequency table, and a ranking table, the model alsodistinguishing between normal and abnormal biometric measurements of thecapturing device based on a history of biometric measurements of thecapturing device; performing real-time recursive quantile estimation onvalues of the at least one biometric profile variable to generate anestimate of quantiles of a biometric metric profile variabledistribution, the performing including recasting the values of the atleast one biometric profile variable into dimensionless values expressedin terms of a real-time estimate of the quantiles of the biometricmetric profile variable distribution; comparing, by the at least onedata processor, the biometric data associated with the consumer withdata associated with a global population; calculating, by the at leastone data processor and based on the comparing, at least one scaled valueof the at least one biometric profile variable, the at least one scaledvalue indicating whether a value of the at least one biometric profilevariable comprises an outlier value, the outlier value comprising avalue above a threshold quantile of the biometric metric profilevariable distribution determined from the overall population;generating, by the at least one data processor, a behavioral score forthe consumer based on the collected biometric data, the at least onescaled value, and the at least one biometric profile variable, thebehavioral score representing a second degree of normality of abiometric event associated with the biometric history of the consumerand the global biometric profile variable; augmenting, by the at leastone data processor, the fraud risk score with the behavioral score togenerate an augmented score, the augmented score representing the degreeof risk that the transaction is associated with the fraudulent behaviorand the second degree of normality of the event associated with thebiometric data; defining, by the at least one data processor, one ormore archetypes for the consumer based on the biometric data and thebehavioral score, the one or more archetypes defined utilizing real-timecollaborative profiling based on streaming biometric data collected fromthe capturing device; blending, by the at least one data processor, thebehavioral score with a fraud score to generate a blended fraud score,the fraud score indicating a probability of fraud for a transactionassociated with the consumer, the blending including applying aregression model to blend the behavioral score with the fraud score; andauthenticating, by the at least one data processor and based on theaugmented score and the one or more archetypes, a transaction associatedwith the consumer.
 9. The method in accordance with claim 8, wherein theevent associated with the biometric history of the consumer and theglobal biometric profile variable is part of the transaction, whereinthe outlier variable comprises a variable above a threshold quantile ofthe distribution.
 10. The method in accordance with claim 8, furthercomprising generating, by the at least one data processor, the biometrichistory from a collection of biometric data and an event history over atime period.
 11. The method in accordance with claim 8, furthercomprising defining, by the at least one data processor, one or morearchetypes for the consumer based on the biometric data and the at leastone biometric profile variable.
 12. The method in accordance with claim11, further comprising: aggregating, by the at least one data processor,one or more streams of biometric markers and the at least one biometricprofile variable from a plurality of consumers; and associating, by theat least one data processor, the aggregated one or more streams ofbiometric markers and the at least one biometric profile variable to thedefined one or more archetypes.
 13. The method in accordance with claim12, further comprising: generating, by the at least one data processor,a model based on the one or streams of biometric markers and the atleast one biometric profile variable; and associating, by the at leastone data processor, the collected biometric data and the at least onebiometric profile variable with at least one of the defined one or morearchetypes based on the model.
 14. The method in accordance with claim11, further comprising associating, by the at least one data processor,the fraud score and the behavior score with the one or more archetypesto augment one or more biometric profile variables.
 15. A systemcomprising: at least one programmable processor; and a machine-readablemedium storing instructions that, when executed by the at least oneprocessor, cause the at least one programmable processor to performoperations comprising: collecting, by a capturing device connected withat least one data processor, biometric data associated with a consumer;determining, by the at least one data processor, one or more biometricvariables associated with the consumer, the one or more biometricvariables representing a measurable aspect of the biometric data;generating, by the at least one data processor using a model and basedon at least one of the one or more biometric variables, at least onebiometric profile variable associated with the consumer, the at leastone biometric profile variable representing a first degree of normalityof the collected biometric data as compared to a biometric history ofthe consumer, the model employing a recursive frequency list (RFL) tosummarize a history of the biometric data, the RFL comprising a numbertable, a frequency table, and a ranking table, the model alsodistinguishing between normal and abnormal biometric measurements of thecapturing device based on a history of biometric measurements of thecapturing device; performing real-time recursive quantile estimation onvalues of the at least one biometric profile variable to generate anestimate of quantiles of a biometric metric profile variabledistribution, the performing including recasting the values of the atleast one biometric profile variable into dimensionless values expressedin terms of a real-time estimate of the quantiles of the biometricmetric profile variable distribution; comparing, by the at least onedata processor, the biometric data associated with the consumer withdata associated with a global population; calculating, by the at leastone data processor and based on the comparing, at least one scaled valueof the at least one biometric profile variable, the at least one scaledvalue indicating whether a value of the at least one biometric profilevariable comprises an outlier value, the outlier value comprising avalue above a threshold quantile of the biometric metric profilevariable distribution determined from the overall population;generating, by the at least one data processor, a behavioral score forthe consumer based on the collected biometric data, the at least onescaled value, and the at least one biometric profile variable, thebehavioral score representing a second degree of normality of abiometric event associated with the biometric history of the consumerand the global biometric profile variable; defining, by the at least onedata processor, one or more archetypes for the consumer based on thebiometric data and the behavioral score, the one or more archetypesdefined utilizing real-time collaborative profiling based on streamingbiometric data collected from the capturing device; blending, by the atleast one data processor, the behavioral score with a fraud score togenerate a blended fraud score, the fraud score indicating a probabilityof fraud for a transaction associated with the consumer, the blendingincluding applying a regression model to blend the behavioral score withthe fraud score; and authenticating, by the at least one data processorand based on the blended fraud score and the one or more archetypes, thetransaction associated with the consumer.
 16. The system in accordancewith claim 15, wherein the operations by the at least one programmableprocessor further comprise generating the biometric history from acollection of biometric data and an event history over a time period,wherein the outlier variable comprises a variable above a thresholdquantile of the distribution.
 17. The system in accordance with claim15, wherein the operations by the at least one programmable processorfurther comprise defining one or more archetypes for the consumer basedon the biometric data and the at least one biometric profile variable.18. The system in accordance with claim 17, wherein the operations bythe at least one programmable processor further comprise: aggregatingone or more streams of biometric markers and the at least one biometricprofile variable from a plurality of consumers; and associating theaggregated one or more streams of biometric markers and the at least onebiometric profile variable to the defined one or more archetypes. 19.The system in accordance with claim 18, wherein the operations by the atleast one programmable processor further comprise: generating a modelbased on the one or streams of biometric markers and the at least onebiometric profile variable; and associating the collected biometric dataand the at least one biometric profile variable with at least one of thedefined one or more archetypes based on the model.
 20. The system inaccordance with claim 15, wherein the operations by the at least oneprogrammable processor further comprise generating a fraud risk scorefor the event based at least in part on the behavioral score, the fraudscore representing a degree of risk that the event is associated with afraudulent behavior.
 21. The method in accordance with claim 1, whereindefining, by the at least one data processor, one or more archetypes forthe consumer based on the biometric data and the behavioral scorecomprises defining, using real-time collaborative profiling of aplurality of consumers to define one or more archetypes of the consumerbased on the biometric data and the at least one biometric profilevariable, the method further comprising: determining a change in the oneor more archetypes of the consumer based on the at least one scaledvalue indicating that the value of the at least one biometric profilevariable comprises the outlier value; and intervening with the consumerbased on the determined change in the one or more archetypes of theconsumer and the authenticating.
 22. The method in accordance with claim1, further comprising: calculating, by the at least one data processor,an unsupervised score by summing the at least one device capabilityscaled value.
 23. The method in accordance with claim 22, furthercomprising: determining, by the at least one data processor, a need forinvestigation based on the unsupervised score.